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ABSTRACT 


A method and system for updating virus signature files of a 
computer system. The method includes the steps of storing 
first update data on a storage medium including second 
update data to be installed to the computer system, and 
installing the second update data to the computer system 
wherein the first update data includes virus signature updat- 
ing data. The system includes: a least one computer and the 
portable storage medium adapted to deliver data to the at 
least one computer. The portable storage medium includes 
first and second data wherein the first data includes virus 
signature update data. 

15 Claims, 5 Drawing Sheets 
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SYSTEM AND METHOD FOR AUTOMATED 
ANTI-VIRAL FILE UPDATE 

TECHNICAL FIELD 

The present invention relates generally to a system and 
method for detecting computer viruses, and more particu- 
larly to a system and method for updating the antivirus files 
of a computer system. 

BACKGROUND OF THE INVENTION 

The field of computers has been plagued over the years 
with computer viruses. A computer virus is a program that 
is executed without the knowledge or authorization of the 
user of the computer — the virus typically performing unau- 
thorized and, undesirable_jLctions_on components of the 
computer and/or info rmation stored orTtfie computer. 

These programs are often introduced for malicious 
reasons, and frequently result in substantial damage to the 
computer and/or data stored on the computer. For example, 
some viruses alter or destroy data stored on the computer 
hard drive, scramble characters on video display screens, 
consume computer or network resources, oftentimes result- 
ing in considerable downtime for the computer user and his 
office, in less serious cases, an attack by a computer virus 
may force an organization to replicate or recover data and 
files before it can resume normal operation. In more serious 

(cases, data and files destroyed by a virus may~ become 
unrecoverable, forever shutting down that aspect of the 
0rganiz^tiDTi i s~upeTatioriS7- Additionally, in some cases the 
integrity of an organization's data bases may have been 
attacked without warning, and the organization continues 
operation using inaccurate data, possibly resulting in 
injuries, losses and damages. 

/~ Computer viruses have the particular property of being 
able to replicate themselves and thus spread from one 
computer file to another, one computer volume to another, 
and one machine to another. The viruses may be spread in a 
number'of ways. For example, a virus may spread by adding 
itself to code that already exists within some program on a 
computer, then changing that preexisting code in such a way 
that the newly added viral code will be executed. This 
enables. the virus to execute again and replicate itself in yet 
another program. 

Viruses typically propagate by opportunistically copying 
themselves to ("infecting") a disk that happens to be acces- 
sible when a computer executes the virus. If a user transports 
an_infected disk to a second computer, and„the_second 
computer ex^utes tfievirus, thTvirus then attempts to infect 50 

disks oni hTsecond -compute r, .and so on.~ 

Many software solutions fiav£ been devised to help 
counter these viruses such as for example virus scanner 
programs. The virus scanner program scans a file or set of 
files for particular known viruses. Typically, these "anti- 55 
virus" programs both detect and remove known viruses. The 
$ anti- virus program searches for "signatures", including char- 
acteristic behaviors of viruses and removes any found virus. 
These programs are generally successful at eliminating the 
/ viruses that are known to the scanner program. However, $0 
/ viruses are oftentimes created by malicious computer hack- 
I ers who are continuously producing new and more damag- 
\ ing computer viruses. It is estimated that at least several new 
ip^viruses are introduced each day. 

Although the virus detection programs are good at detect- 65 
ing and eliminating viruses, they are limited in that they can 
generally only detect viruses known to them via their virus 


35 
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signature files. The anti-virus program relies on a fairly Vpv 
extensive library of known computer viruses. As a result, 
new viruses with signatures not listed in the virus signature 
files of a computer oftentimes will go by undetected. Thus, „ 
signature scanning programs require frequent updates 
keep them current with the increasing number of viruses, 
the antivirus developer is lax in providing updates, or the 
user is lax in obtaining and employing available updates, a 
signature scanning anti-virus program can rapidly lose its 
effectiveness. Consequently, the new virus may be able to 
damage the computer and/or the information stored thereon. 
Therefore, a conventional virus detection program may 
become obsolete within only a few months after installation. 

Furthermore, the aforementioned updating problem is not 
solely limited to virus signature files but also is prevalent in 
other areas where particular software utilizes reference files 
that need to be updated frequently in order for the system 
using the software to operate at peak efficiency. 

Accordingly, ifTlight of the above, there is a strong need 
in the art for an improved system and method for updating\ * 
the virus signature files of a computer and/or computer \ ( 
svstem.without puttinfl-the ^onus of u pdating on the user so' \ c \ f^r^ 
thaLj m jnd- virus progra m^stored thereon will _be able to / v 
detecl^nd^hmn ia"te~vinises inc luding newly created ones. / 
Moreover, there is a strong need~uTthe arTforan improved 
system and method for updating reference files of a com- 
puter and/or computer system without putting the onus of 
updating on the user. 

SUMMARY OF THE INVENTION 

The present invention in particular relates to a system and V. w>j*« 
method for updating virus signature files of a computer j y \ 
and/or computer system so that an anti-virus program stored / 
thereon will be able to detect and eliminate viruses including ' 
newly created ones. However, as will be discussed below, 
the present invention has applicability to updating reference 
files of a computer and/or computer system without putting 
the onus of updating on the user. 

Briefly, the present invention provides a set of virus 
signatures files on a storage medium such as a floppy disk or 
CD-ROM that is being used to install a program, files or 
other data to a computer or computer system. Along with the 
program or data being installed, the virus signature update 
files are also provided-to the computer or computer-system. 
The virus signature,upd ate, fi les be ing d ownlo aded include 
( the mosUrecently available si gnatures fqr_ jmown viruses. 
Tbe-computer.orj^mputer s ystem re ceiving.the_Cle_sjip"dates 
its current_virus sig nature files to in clude any new virus 
signataresjfoat.are.bemg.downloade^^ 
an a1nti^irus„prograrn_js_jej£ecuted b y the c omputer or 
computer system,_it_wiir^e~able~t6~aetect new types of 
viruses via-the-newly added virus signatures. 

As was mentioned above, the present invention can also 
be utilized to update any suitable reference files of a com- 
puter and/or computer system without putting the onus of 
updating on the user.* 

According to embodiment of the present invention/ a 
method for updating virus signature files of a computer \ 
system is provided including the steps of: storing first and \ 
second update data on a portable storage medium to be \ 
installed to the computer system, the first update data / 
including virus signature updating data, the second data / 
including data that is regularly delivered to the computer / 
system; and installing the second update data to the com- / 
puter system. 

According to yet another embodiment of the present 
invention, a portable storage medium for updating data of a 
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computer is provided including: first and second data; The anti- virus program executed by the computer or com- 

wherein the first data includes virus signature update data puter system, will be regularly updated so that it will be able 

and the second data includes data that is regularly delivered to detect new types of viruses via its newly added virus 

to the computer. signatures. 

According another embodiment of the present invention, 5 Referring initially to FIG. 1, a detailed block diagram of 

a computer system is provided including: a least one com- a computer system 10 is shown in accordance with the 

puter, and a portable storage medium adapted to deliver data P rc f n 1 t «™ntioa. ™'™f±f ^ em 1 ° » 

to the at least one computer, the portable storage medium ^tral ? T ™? m * Umt ( CP ^ 20 W £ ich 15 t0 * bus f 

« j • c . . j j * i_ • *u « * j * 22 - The cpu or processor 20 can be any of a plurality of 

mcuding first and second data, wherein the first data ssor ^ SUCQ ^ the ^60X133, 486DX2/66, 486DX4/ 

includes virus signature update data. ™ 50 _ 100> 486DX4/33-100, 486DX4/33:83, p24T, Pentium 

In accordance with yet another aspect of the invention, a 50/75, Pentium 60/90, and Pentium 66/100, and other simi- 

method for updating reference files of a computer system is lar and compatible processors. The processor 20 functions to 

provided including the steps of: storing first and second perform various operations described herein as well as for 

update data on a portable storage medium to be installed to carrying out other operations related to the system 10. The 

the computer system, the first update data including refer- 15 manner in which the processor 20 can be programmed to 

ence file updating data, the second data including data that carry out the functions relating to the present invention will 

is regularly delivered to the computer system; and installing be readily apparent to those having ordinary skill in the art 

the second update data to the computer system. based on the description provided herein. 

To the accomplishment of the foregoing and related ends, The bus 22 includes a plurality of signal lines 24 for 

the invention, then, comprises the features hereinafter fully conveying addresses, data and controls between the CPU 20 

described and particularly pointed out in the claims. The and a number of other system bus components. The other 

following description and the annexed drawings set forth in s y stem bus components include a memory 28 (including a 

detail certain illustrative embodiments of the invention. Random Access Memory (RAM) 30 and a Read Only 

These embodiments are indicative, however, of but a few of Memory (ROM) 32) and a plurality of input/output (I/O) 

the various ways in which the principles of the invention devices. The memory 28 serves as data storage and may 

may be employed. Other objects, advantages and novel s t° re appropriate operating code to be executed by the 

features of the invention will become apparent from the processor 20 for carrying out the functions described herein, 

following detailed description of the invention when con- The RAM 30 provides program instruction storage and 

sidered in conjunction with the drawings. 3Q working memory for the CPU 20. The ROM 32 contains 

software instructions known as the Basic Input/Output Sys- 

BRIEF DESCRIPTION OF THE DRAWINGS tem (BIOS) for performing interface operations with the I/O 

.,1,. r . . • devices. Also stored in the ROM 32 is\a software routine 

FIG. 1 is a block diagram of a computer system in ,. , 4 . , , t > , 

... ^ . , ■ r J which operates to load a boot program from the booting 

accordance with the present invention; , * , . _ .„ . . n . „ . „ 

v device. The boot program will typically be executed when 

FIG. 2 is a representative table diagram of virus signature 35 ^ computer system 10 ^ powered on or wnen initialization 

files in accordance with the present invention; of lhe system 10 ^ neede d. \ 

FIG. 3 is an elevation view of a portable storage medium xh c r/o devices include basic devices such as data storage 

in accordance with the present invention; devices (e.g., floppy disks, tape drives, CD ROMs, hard, 

FIG. 4 is a system flowchart illustrating one embodiment 4Q disks, etc.). Typically, the I/O devices communicate with the 

of the present invention; and CPU 20 by generating interrupts. The CPU 20 distinguishes 

FIG. 5 is a system flowchart of another embodiment of the interrupts from among the I/O devices through individual 

present invention. interrupt codes assigned thereto. Responses of the CPU 20 

to the I/O device interrupts differ, depending, among other 

DESCRIPTION OF THE PREFERRED things, on the devices generating the interrupts. Interrupt 

EMBODIMENTS vectors are provided to direct the CPU 20 to different 

The present invention will now be described with refer- interrupt handling routines, 

ence to the drawings, wherein like reference numerals are The interrupt vectors are generated during initialization 

used to refer to like elements throughout. ( ie > boot U P) of the computer system 10 by execution of the 

As is mentioned above, the present invention relates to a 50 BI0S - Because responses of the CPU 20 to device interrupts 

.system and method for updating virus signature files of a ma ? need t0 be changed from time to time, the interrupt 

/computer and/or computer system so that an anti-virus vectors may need to be moojfied from time to time m order 

( program stored thereon will be able to detect and eliminate 10 direct CPU 20 t0 mterm P l handlm g ro L ulmes - 

V viruses including newly created ones. The present invention To for modification of the interrupt vectors, they are 

provided set of updated virus signatures files on a recording 55 stored ia the RAM 30 durin g operation of the computer 

medium such as a floppy disk or CD-ROM that is being used system 10. 

to install a program, files or other data to a computer or A disk control subsystem 40 birectionally couples one or 

computer system. Along with the program or data being raore disk drives 42 ( e -g-> flo PPy dis H drives > CD-ROM 

i nstalled , the u pdated virus si gnatures files are alsaprovided drives, etc.) to the system bus 22. The disk drive 42 works 

to the computer or computer system. The Virus signature 60 ™ conjunction with a removable storage medium such as a 

"files-beifi llio^lo aded-include the most" recently available floppy diskette or CD-ROM. 

sig natures fo r known viruses, ThTWmputer or com puter A hard drive control subsystem 46 bidirectionally couples 

system jg^jying nrje'fjles u pdaTeT TtTclmihTvirus signa ture a rotating fixed disk, or hard drive 48 to the system bus 22. 

files to include any new virus signatures that are being The hard drive control subsystem 46 and hard drive 48 

downioTdedrThuspaccording-to-the present invention, a 65 provide mass storage for CPU instructions and data, 

computer system's virus signature files are automatically A terminal control subsystem 56 is also coupled to the bus 

updated with the installation of new data and/or programs. 22 and provides output to a display device 58, typically a 
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CRT monitor, and receives inputs from a manual input 
device 60 such as a keyboard. Manual input may also be 
provided from a pointing device such as a mouse. 

A network adapter 70 is provided for coupling the system 
10 to a network. 

The components illustrated in FIG. 1 may be embodied in 
a personal computer, a portable computer, a workstation, a 
minicomputer, a main frame computer, or a super computer. 
As such, the details of the physical embodiment of the data 
processing system 10 such as structure of the bus 22 or the 
number of CPUs 20 that are coupled to the bus 22, is not 
crucial to the operation of the invention and thus is not 
described in further detail below. 

i The computer system 10 scans all relevant media (e.g., 
files, boot records, memory, etc.) for the presence of known 
viruses in the following manner. A pre-existing virus scanner 
is activated to search for a large set of patterns or signatures, 
each of which pertains to a different virus or virus family. 
The signature scanner operates by knowing what a target 
virus will look like based on the "signature" code for that 
virus and then scanning for these program codes in any 
program requested to be executed or otherwise requested to 
be scanned. As long as the signature codes are sufficiently 
long enough so as not to be confused with another's program 
code, then positive identification is virtually guaranteed and 
the request to execute the infected program can be stopped 
before execution ever begins. 

It is preferred (but not essential) that the virus scanner be 
capable of detecting slight variations on known viruses. 
Many conventional scanners possess this capability, to a 
limited extent, because they search based on short contigu- 
ous strings of bytes found in the virus. This is particularly 
useful for detecting variations of known viruses because it 
permits a certain number of mismatches between a string of 
bytes in a file being examined and the virus signature string. 
If a virus is found, the user is alerted, and the virus is 
eliminated by traditional methods such as restoration from 
backup (either automatically or manually by the user) or 
disinfection (removal of the virus from all of the software it 
has infected.) In general disinfection is only acceptable if the 
virus is found to be an exact copy of a known virus. This 
implies that the system 10 verify the identification made by 
the virus scanner. 

As mentioned above, the virus scanner bases its search on 
known virus signatures. These signatures are a sequential 
portion of code, typically up to 16 bytes in length, unique to 
each virus. Those of skill in the art are familiar with the 
signatures of many known viruses, and lists of such viruses 
(including their signature) are often published in various 
technical bulletins, which are periodically updated. 

To facilitate an efficient signature scan function, and to 
prevent the stored virus signatures themselves from causing 
false alarms, the signatures are stored in a series of tables as 
illustrated in FIG. 2. In the preferred embodiment, the 
signature table is stored in the permanent memory of the 
computer system 10. Each signature element 100 in signa- 
ture tables 110(1) through 110(z) contain the value of one 
byte of one virus signature: that is, the nth element in 
signature 110(1) contains the second byte in the nth virus 
signature, the nth element of signature table 110(2) contains 
the third byte in the zth virus signature, and so on, through 
the signature table 110(z). Thus, the number of signature 
tables 110 provided should equal the length of the longest 
virus signature to be scanned for minus one, and the number 
of signature elements 100 in each signature table 110 should 
equal the number of virus signatures to be scanned for. 
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Furthermore, the signature elements 100 in the signature 
tables should be sorted according to ascending numerical 
order of the corresponding virus signatures. 

In order to gain access to the signature tables 110 an index 

5 table 120 is preferably used. Each index element 124 of 
index table 120 corresponds to each possible byte value 130 
for the first byte type of a virus signature; the table 120 
should therefore have room for 256 elements which is the 
number of different values possible for one byte of data. The 

10 index elements 124 should be sorted in the ascending order 
of the corresponding byte values 130. Each index element 
124 contains two fields: signature count field 140 which 
contains the number of virus signatures that begin with the 
corresponding byte value 130, and a pointer field 150, which 

35 specifies (index n) the location in subsequent tables 110(1) 
through 110(z) where the elements corresponding to signa- 
tures beginning with the byte value 130 are stored. 

The foregoing data structure facilitates an efficient signa- 
ture scan procedure. When memory is scanned, the first 

20 memory byte examined is used as an index to specify an 
index element to 124 in index table 120. If signature count 
field 140 indicates that no signatures begin with this byte, 
the scan process is restarted for the next byte in memory. If 
signature count field 140 in the specified index element 

25 indicates that one or more virus signatures do begin with the 
byte being examined, then the relevant signature elements 
100, stored in signature tables 110(1) through 110(z), as 
determined from pointer field 150, are compared to succes- 
sive bytes in memory until either a complete virus signature 

30 match is found, or until the memory being examined is fully 
scanned. For purposes of knowing when a signature match 
is complete, an extra signature length table 158 is preferably 
provided, wherein the mth length element 160 of the signa- 
ture length table 158 contains the length of the virus signa- 

35 ture corresponding to the zth elements of the table 110. 
Returning back to the search, main memory (which may 
include any extended, expanded or other additional RAM 
memory included within the computer system 10) preferably 

40 is scanned first because there are a number of "stealth" 
viruses that avoid detection by hiding in a memory before a 
program is run. Preferably, system files (such as 
COMMAND.COM) are also searched, as are boot strap 
loader records, including those on any floppy disks in place. 

45 If desired, scanning of system files and boot records can be 
skipped to improve speed, but at some loss in security. 

Turning now to FIG. 3, a preferred portable storage 
medium 170 is shown in accordance with the present 
invention. The preferred storage medium is a diskette with 

50 representative tracks 172, each track having sectors such as 
for example sector 180. In the preferred embodiment all 
tracks contain two additional sectors to provide for 160 KB 
of hidden partitions on an 80-track diskette. The virus 
signature update data is stored thereon so as to be inacces- 

55 sible to some degree to conventional programs. By storing 
the update data in the hidden partitions, conventional storage 
capacity of the storage medium is not reduced. The virus 
signature update data is preferably stored in a compressed 
form and decompressed prior to installation to system 10. 

60 The two additional sectors at the end of each track provide 
a rotational delay between the last conventional sector. The 
delay provides the disk drive 42 enough time to reposition 
the head on the next track before the first sector of the next 
track passes under the head thereby speeding up access to 

65 data on the diskette. However, it will be appreciated that the 
present invention has applicability to any suitable storage 
medium (e.g., diskette, CD-rom, tape drive, etc.). 
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Referring now to FIG. 4, a flowchart that represents the proceeds to step 270 where the user is presented an option 

general operations the present invention is shown. Set out to supervise the updating of the virus signature files 110. In 

below is an illustration of the update program for applying step 280, the user is displayed the virus signature update data 

virus signature modifications or updates to the virus signa- fr om the disk 170 and is allowed to manually select which 

ture files 110 of the system 110. The update program is in 5 new virus signatures he/she wants to apply to the virus 

program design language from which source code and signature files 110. It will be appreciated that brief descrip- 

machine code are derivable. In the following general tions of the various viruses can be coupled to the respective 

description of the update program, it is to be assumed that vifUS si ^ atures m order to facilitatc me ^ makirlg his/her 

system 10 is under mouse and keyboard device control. selection 

Moreover, it is assumed that the update program is invoked in , , , 

from a driver program contained in the operating system 10 . In ste P 290 ' *e processor 20 applies the user selected 

which facilitates the display of all of the screen panels, the virus signature update fi « and thus updates the virus 

monitoring of the keyboard 22 and the installation of the suture flies 110. After step 290 the processor 20 returns 

plurality of separately installable features or components of '° st «P 2 , 50 » wlU be "PP^ated that a variety of steps can 

the software program added to this process or even some steps removed to carry 

T , lL * - " j it . j - . , A 15 out the present invention all of which fall within the scope 

If the user has selected the prompted mode, the update - , r t . r 

*u v 11 r j j* / ii #■ *u of the present invention, 

program then applies all unapplied updates to all of the r 

installed features or components prior to returning control to FlG - 5 1S a flowchart depicting another embodiment of the 

the operating system. If the user has selected the full P resent invention. At step 300, the user inserts the storage 

function mode, the update program prepares a screen panel M medium 42 into a computer that is part of the system 10. In 

which displays a list of all of the features or components of ste P 310 » ^e Processor 20 of the computer compares the 

the software program installed on system 10 and respective versions of virus signature update files on the medium 

value of the highest sequential update that can be applied to a S amst the virus signature files 110 on the system 10. If all 

each of the features. Thereafter, when the update program of tne u P datc virus signature files on the storage media are 

returns control to the driver program, the driver program „ me same or older than that stored in the virus signature files 

displays to the user on the display 20 the prepared screen 110 011 svstcm 10 the processor 20 proceeds to step 360 

panel. The user is then permitted to lower any of the update where u carnes on routme operations of associated with the 

values associated with any of the displayed features. system 10. 

At step 200, in response to an initialization, or power-up However, if in step 310 the processor determines that at 

signal the processor 20 executes a brief program stored in 30 least one of the virus signature update files is not found in 

the ROM 32 which is an integral part of processor 20 the virus signature files 110 of the system 10, the processor 

loading a boot loader program stored in a predetermined 20 proceeds to step 320 where it prompts the user to decide 

location of the portable storage medium 170 (i.e., disk) that whether t0 u P date the virus signature files 110. If the user 

is inserted in the disk drive 42. In step 210, the processor 20 ^cides no, the processor 20 advances to step 360 where it 

performs general initializations in a conventional manner, 35 carries on rouline operations of associated with the system 

well known to those skilled in the art. At step 220, in 10 If tbc ^ decidcs that hc ' snc docs ™ sh t0 u P date thc 

response to the initialization signal, the processor 20 may vims signature files 110, the processor 20 proceeds to step 

load an update program, which is stored in locations corre- 330 where it copies the old versions of the virus signature 

sponding to the boot loader on the disk 170. The boot loader files 110 t0 a temporary buffer (to save for use in case the 

program then loads the system program stored on the disk 40 u P date 1S not completed properly. Then m step 340, the 

170 into the memory of system 10 and transfers control to processor 20 adds the virus signature updates to the virus 

the systems program. The systems program identifies the signature files 110. In this step, duplicate virus signature files 

target drive to load the general data stored on the disk 170. are overwritten with the updated versions and the virus 

The system program also identifies the target drive and path signature updates that are new to the system are added to the 

to the system's virus signature files 110. 45 virus signature files 110. 

At step 230, the processor 20 prompts the user if an auto The entire virus signature file 110 is not completely 

update is desired. In this prompted mode, which is intended overwritten with the update virus signature files since the 

for use by less sophisticated users, a method of updating the storage medium 170 might only contain new vims signa- 

virus signature files 110 with a minimum number of deci- tures rather man a comprehensive list of all virus signatures, 

sions is provided. A full function mode, which is intended to 50 T^' an updating is preferably performed as opposed to a 

be used by sophisticated users, provides a menu driven complete new installation of virus signature files. After step 

method enabling the user to select (1) different functions of 340 is complete successfully, the processor 20 in step 350 

the update program and (2) the order of execution of the c ^ars the buffer then proceeds to step 360 where it carries 

selected functions. If in step 230 the decision to auto update on routine operations of associated with the system 10. 

is yes, the processor 20 proceeds to step 240. In step 240, the 55 The present invention thus allows for a user to update the 

processor copies the new virus signature data from the disk virus signature files of his/her system without having to go 

to a memory buffer (not shown) of the system 10. The out of his/her way in order to update the virus signature files 

processor 20 in step 246 updates the virus signature files 110 110. The present invention may be employed in almost any 

with the new virus signature data from the disk 170. environment where computers are involved, however, it is 

If in step 230, the user does not desire an auto update the 60 particularly useful in the medical industry where system and 

processor 20 proceeds to step 250. In step 250 a display file integrity in critical. 

menu is made available to the user. The display menu may For example, the present invention may be used in the cell 

provide a number of user options some of which are related classification industry where speed and accuracy of cervical 

to updating the virus signature files 110. In step 260, the smear analysis is critical. The examination of a cervical 

processor 20 determines if the virus signature update files 65 smear by what often is referred to as a PAP test is a mass 

have been applied. If yes, the processor 20 ends this routine screening cytological examination which requires inspection 

and proceeds to handle other matters. If no, the processor 20 of hundreds of thousands of cells per slide. The screening 
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process has become automated to the extent that images are 
taken of the thousands of slides. The images are stored on a 
transportable storage medium 170 such as a disk for review 
and analysis at a remote site. It is critical that the systems 
used in performing the cytological examinations be virus 5 
free. Otherwise, possible misdiagnosis might result which 
could in turn result in a person having cervical cancer go 
undetected. 

The present invention may be employed in this field by 
attaching virus update files to the storage medium 170 that 10 
is storing the cervical smear images. Thus, when the images 
are being downloaded at the remote site for analysis the 
virus update files can be applied to the computer system 10 
of the remote site in the manner described above. Thus, in 
environments such as this where data is being regularly ]5 
downloaded to a system the present invention facilitates 
detection of viruses thus providing increased protection 
from system and file corruption due to infection by a 
computer virus. 

The present invention is not limited to simply updating 
virus signature files 110 but may also be employed in other 
environments where reference files must be meticulously 
updated to ensure system operating efficiency. For example, 
in a business/legal environment reference files are main- 
tained containing benchmark data that is used in conjunction 
with various software applications. For instance in a law 
firm database rules, regulations and various statutory dates 
and deadlines are stored in files that are referenced by 
software applications that use the reference data in making 
computations and decisions. If the reference data is 
incorrect, then it is highly probable that the output compu- 
tation and/or decision made by the software is erroneous. 
Thus, if update reference data were stored on a storage 
medium 170 in conjunction with regular data that is to be 
applied to the system 10 (in a similar manner to that 
described above with respect to the virus signature updates), 
the system 10 would be using the most recent reference data. 

Those skilled in the art will recognize that the embodi- 
ment described above and illustrated in the attached draw- 4(J 
ings are intended for purposes of illustration only and that 
the subject invention may be implemented in various ways. 
Thus, it is to be understood that the embodiments described 
above are not to be considered as limiting and limitations on 
the subject invention are to be found only in the attached 45 
claims. 

What is claimed is: 

1. A method for updating virus signature files of a 
computer system comprising the steps of: 

storing first and second update data on a portable storage 50 
medium to be installed to the computer system, the first 
update data including virus signature updating data, the 
second data including data that is regularly delivered to 
the computer system; 

installing the second update data to the computer system; 55 
and 

prompting a user of the computer system to decide 
whether or not to update the virus signature files with 
the first data. 

2. The method of claim 1 further including the step of 60 
updating the virus signature files with the first data. 

3. The method of claim 1 wherein the storage medium is 
a floppy diskette. 


20 


25 


30 
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4. The method of claim 1 wherein the storage medium is 
a CD-ROM. 

5. The method of claim 1 wherein the virus signature files 
are automatically updated with the first data when the 
second data is being delivered to the computer system. 

6. The method of claim 5 wherein the first data is 
decompressed prior to being used to update the virus sig- 
nature files. 

7. The method of claim 1 wherein the second data 
includes an executable software program. 

8. The method of claim 1 wherein the storage medium is 
a removable medium adapted to be read by the computer 
system. 

9. The method of claim 1 further including the step of the 
user selecting at least one portion of the first data to be used 
to update the virus signature files. 

10. The method of claim 1 wherein the portable storage 
medium further includes a hidden partition comprising stor- 
age space inaccessible to conventional programs and not 
reducing conventional storage capacity of the storage 
medium, wherein the first data is stored thereon. 

11. A method for updating virus signature files of a 
computer system comprising the steps of: 

storing first and second update data on a portable storage 
medium to be installed to the computer system, the first 
update data including virus signature updating data, the 
second data including data that is regularly delivered to 
the computer system; 

installing the second update data to the computer system; 
and displaying to the user a first target drive and 
directory where the virus signature files are stored. 

12. A computer system comprising: 
at least one computer; 

a portable storage medium adapted to deliver data to the 
at least one computer, the portable storage medium 
including first and second data, wherein the first data 
includes virus signature data, the portable storage 
medium further including a hidden partition compris- 
ing storage space inaccessible to conventional pro- 
grams and not reducing conventional storage capacity 
of the storage medium, wherein the first data is stored 
thereon. 

13. A method for updating reference files of a computer 
system comprising the steps of: 

storing first and second update data on a portable storage 
medium to be installed to the computer system, the first 
update data including reference file updating data, the 
second data including data that is regularly delivered to 
the computer system, the portable storage medium 
further including a hidden partition comprising storage 
space inaccessible to conventional programs and not 
reducing conventional storage capacity of the storage 
medium, wherein the first data is stored thereon; and 

installing the second update data to the computer system. 

14. The method of claim 13 further including the step of 
updating the reference files with the data. 

15. The method of claim 13 wherein the reference files are 
automatically updated with the first data when the second 
data is being delivered to the computer system. 
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